MySQL Enterprise Monitor 3.1.x < 3.1.7.8023 / 3.2.x < 3.2.7.1204 / 3.3.x < 3.3.3.1199 Multiple Vulnerabilities (April 2017 CPU)

Critical Nessus Plugin ID 99593

Synopsis

A web application running on the remote host is affected by multiple vulnerabilities.

Description

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.1.x prior to 3.1.7.8023, 3.2.x prior to 3.2.7.1204, or 3.3.x prior to 3.3.3.1199. It is, therefore, affected by multiple vulnerabilities :

- A denial of service vulnerability exists in the Apache Commons component in the FileUpload functionality due to improper handling of file upload requests. An unauthenticated, remote attacker can exploit this, via a specially crafted content-type header, to cause a denial of service condition. Note that this vulnerability does not affect MySQL Enterprise Monitor versions 3.3.x.
(CVE-2016-3092)

- An unspecified flaw exists in the Apache Struts component that is triggered during the cleanup of action names. An unauthenticated, remote attacker can exploit this, via a specially crafted payload, to perform unspecified actions. (CVE-2016-4436)

- A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055)

- An unspecified flaw exists in the Monitoring Server subcomponent that allows an authenticated, remote attacker to impact confidentiality and integrity.
(CVE-2017-3306)

- An unspecified flaw exists in the Monitoring Server subcomponent that allows an authenticated, remote attacker to impact integrity and availability.
(CVE-2017-3307)

- An out-of-bounds read error exists in the OpenSSL component when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731)

- A carry propagating error exists in the OpenSSL component in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys.
(CVE-2017-3732)

- A remote code execution vulnerability exists in the Apache Struts component in the Jakarta Multipart parser due to improper handling of the Content-Type, Content-Disposition, and Content-Length headers.
An unauthenticated, remote attacker can exploit this, via a specially crafted header value in the HTTP request, to execute arbitrary code. (CVE-2017-5638)

Solution

Upgrade to MySQL Enterprise Monitor version 3.1.7.8023 / 3.2.7.1204 / 3.3.3.1199 or later as referenced in the April 2017 Oracle Critical Patch Update advisory.

Note that the 3.2.x version was fixed for the CVE-2016-4436 vulnerability in version 3.2.6.1182.

See Also

http://www.nessus.org/u?d679be85

http://www.nessus.org/u?50229a1a

http://www.nessus.org/u?eb4db3c7

https://support.oracle.com/rs?type=doc&id=2244179.1

https://support.oracle.com/rs?type=doc&id=2279658.1

http://blog.talosintelligence.com/2017/03/apache-0-day-exploited.html

http://www.nessus.org/u?77e9c654

Plugin Details

Severity: Critical

ID: 99593

File Name: mysql_enterprise_monitor_3_3_3_1199.nasl

Version: 1.15

Type: remote

Family: CGI abuses

Published: 2017/04/21

Updated: 2019/11/13

Dependencies: 46815

Configuration: Enable paranoid mode

Risk Information

Risk Factor: Critical

CVSS Score Source: CVE-2017-5638

CVSS v2.0

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:H/RL:OF/RC:ND

CVSS v3.0

Base Score: 10

Temporal Score: 9.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:X

Vulnerability Information

CPE: cpe:/a:oracle:mysql_enterprise_monitor

Required KB Items: installed_sw/MySQL Enterprise Monitor, Settings/ParanoidReport

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2017/04/18

Vulnerability Publication Date: 2016/06/21

Exploitable With

CANVAS (CANVAS)

Core Impact

Metasploit (Apache Struts Jakarta Multipart Parser OGNL Injection)

Reference Information

CVE: CVE-2016-3092, CVE-2016-4436, CVE-2016-7055, CVE-2017-3306, CVE-2017-3307, CVE-2017-3731, CVE-2017-3732, CVE-2017-5638

BID: 91280, 91453, 94242, 95813, 95814, 96729, 97724, 97844

CERT: 834067

EDB-ID: 41570, 41614